Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces

Lubin Meng, Xue Jiang, Xiaoqing Chen, Wenzhong Liu, Hanbin Luo, Dongrui Wu

TL;DR

This work exposes security vulnerabilities in EEG-based BCI systems by introducing two filtering-based adversarial attacks: a universal adversarial filter for evasion and the same filter serving as a backdoor key for poisoning-based attacks. The evasion approach formulates a shared filter $\mathbf{W}$ that minimizes a combination of cross-entropy loss and distortion, optimized with binary search to force the filtered data to the chance level across multiple models and datasets. The backdoor approach poisons training data with filtered samples to embed a backdoor that triggers the target class when inputs are processed by the same filter, achieving high ASR with minimal impact on benign performance. Across three EEG datasets and various architectures, both attacks prove effective and transferable, underscoring an urgent need for defenses and secure signal-processing practices in BCIs.

Abstract

A brain-computer interface (BCI) enables direct communication between the brain and an external device. Electroencephalogram (EEG) is a common input signal for BCIs, due to its convenience and low cost. Most research on EEG-based BCIs focuses on the accurate decoding of EEG signals, while ignoring their security. Recent studies have shown that machine learning models in BCIs are vulnerable to adversarial attacks. This paper proposes adversarial filtering based evasion and backdoor attacks to EEG-based BCIs, which are very easy to implement. Experiments on three datasets from different BCI paradigms demonstrated the effectiveness of our proposed attack approaches. To our knowledge, this is the first study on adversarial filtering for EEG-based BCIs, raising a new security concern and calling for more attention on the security of BCIs.

Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces

TL;DR

This work exposes security vulnerabilities in EEG-based BCI systems by introducing two filtering-based adversarial attacks: a universal adversarial filter for evasion and the same filter serving as a backdoor key for poisoning-based attacks. The evasion approach formulates a shared filter that minimizes a combination of cross-entropy loss and distortion, optimized with binary search to force the filtered data to the chance level across multiple models and datasets. The backdoor approach poisons training data with filtered samples to embed a backdoor that triggers the target class when inputs are processed by the same filter, achieving high ASR with minimal impact on benign performance. Across three EEG datasets and various architectures, both attacks prove effective and transferable, underscoring an urgent need for defenses and secure signal-processing practices in BCIs.

Abstract

A brain-computer interface (BCI) enables direct communication between the brain and an external device. Electroencephalogram (EEG) is a common input signal for BCIs, due to its convenience and low cost. Most research on EEG-based BCIs focuses on the accurate decoding of EEG signals, while ignoring their security. Recent studies have shown that machine learning models in BCIs are vulnerable to adversarial attacks. This paper proposes adversarial filtering based evasion and backdoor attacks to EEG-based BCIs, which are very easy to implement. Experiments on three datasets from different BCI paradigms demonstrated the effectiveness of our proposed attack approaches. To our knowledge, this is the first study on adversarial filtering for EEG-based BCIs, raising a new security concern and calling for more attention on the security of BCIs.

Paper Structure

This paper contains 16 sections, 5 equations, 8 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Adversarial Filtering Based Evasion Attack
  3. filter Based Backdoor Attack
  4. Experimental Settings
  5. Datasets
  6. Deep Learning Models to be Attacked
  7. Traditional Models to be Attacked
  8. Performance Metrics
  9. Experimental Scenarios
  10. Results
  11. Evasion Attack Performance
  12. Backdoor Attack Performance
  13. Transferability of the Adversarial Filter
  14. Influence of the Trade-off Parameter $\alpha$ in Evasion Attack
  15. Influence of the Number of Poisoning Samples in Backdoor Attack
  16. ...and 1 more sections

Figures (8)

  • Figure 1: Adversarial attacks to EEG-based BCIs. (a) A closed-loop EEG-based BCI system; (b) adversarial attacks by inserting a jamming module between signal processing and machine learning; and, (c) adversarial filtering based attack.
  • Figure 2: Illustration of adversarial filtering based backdoor attack. (a) The procedure of backdoor attack; and, (b) poisoning an EEG trial using an adversarial filter.
  • Figure 3: EEG trials before and after adversarial filtering. (a) ERN; (b) MI; and, (c) P300. The differences are magnified $5$ times for better visualization.
  • Figure 4: Average Cz channel spectrograms of the benign EEG trials, the EEG trials after adversarial filtering, and their differences. (a) ERN; (b) MI; and, (c) P300.
  • Figure 5: Average topoplots of the benign EEG trials, the EEG trials after adversarial filtering, and their differences. (a) ERN; (b) MI; and, (c) P300.
  • ...and 3 more figures